Abstract Linking a digital image or video to its originating device, or checking the content integrity still represent challenging forensic tasks. Even though several technologies based on metadata, file format, and sensor fingerprint have been developed to address these problems, they are frequently made obsolete by new customized acquisition pipelines implemented by manufacturers. Therefore, to assess the performance of their tools, researchers continuously need new datasets containing contents captured with recent technologies.
Abstract Identifying the originating social network of a digital video is considered a relevant task to support law enforcement agencies and intelligence services in tracing producers of deceptive visual contents. Recent advances in video forensics highlighted how the structure of video containers can be extremely effective in determining the social network of provenance. However, current studies do not consider that a malicious user could easily launder the traces of the social network by rebuilding the container without transcoding.
Abstract For the last two decades Image Forensics has been providing an arsenal of forensic tools to detect tampered images. At the same time, anti-forensics technologies kept evolving to mislead forensic detectors. Such attacks are generally designed to affect a single forensic trace (e.g. JPEG compression, sensor patter noise, histogram statistics) without considering that the image alteration can negatively affect other traces, thus making harder to mimic multiple statistics of natural images.
Abstract Most image forensics techniques rely on the analysis of traces left into the signal during the image acquisition process, which is supposed to be common among most devices. However, recent advances in visual technologies led several manufacturers to customize the acquisition pipeline in order to improve the image quality, by designing alternative coding schemes and in-camera processing. This fact threatens the effectiveness of available forensic techniques. It is thus required to study modern acquisition devices to both assess the effectiveness of available techniques and to develop new effective approaches.
Abstract Most video forensic techniques look for traces within the data stream that are, however, mostly ineffective when dealing with strongly compressed or low resolution videos. Recent research highlighted that useful forensic traces are also left in the video container structure, thus offering the opportunity to understand the life-cycle of a video file without looking at the media stream itself. In this paper we introduce a container-based method to identify the software used to perform a video manipulation and, in most cases, the operating system of the source device.